Repository navigation
Group Dependabot updates more broadly - #2458
Draft
theseanything wants to merge 5 commits into
Draft
theseanything wants to merge 5 commits into
theseanything wants to merge 5 commits into
Conversation
We get a steady stream of PRs to bump actions, most of them for `ruby/setup-ruby`, which releases most weeks. Bumping our actions is low risk, so we can review them together in one PR each week. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each week brings a few gem bumps, but they're spread across lots of gems, so the groups for specific gems still leave us with mostly single-gem PRs. Grouping minor and patch bumps by Gemfile group gives us at most two PRs a week, and keeps test tooling bumps separate from the gems we run in production. The AWS SDK gems now fall into the production group. The Sentry and Vite Ruby groups only need to handle major bumps, which the new groups leave out, so those gems still get bumped together. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Rails minor releases can change framework defaults and deprecate behaviour, so we want to review them on their own rather than as part of the production gems group. Rails patch releases are still grouped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Most of our npm PRs are for build and test tooling such as Vite, Vitest, Sass and PostCSS, which release often. Our CI checks that a bump to these still builds and passes tests, so they can share a weekly PR. govuk-frontend and dfe-autocomplete change what users see, so they still get their own PRs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Version update groups don't apply to Dependabot security updates, so these still arrive one dependency at a time, mostly for packages we don't depend on directly, such as undici, js-yaml, rack and nokogiri. Grouping them per ecosystem means fewer PRs to review. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
🎉 A review copy of this PR has been deployed! It is made of up two components It may take 5 minutes or so for the application to be fully deployed and working. If it still isn't ready For the sign in details and more information, see the review apps wiki page. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What problem does this pull request solve?
Trello card:
Dependabot opens about 8 PRs a week on this repo, mostly for single dependencies. This groups minor and patch bumps so we get fewer PRs to review:
Majors, Rails minor upgrades and npm production packages such as govuk-frontend still get their own PRs. Schedules stay weekly.
Applying this to last year's bumps gives about 4 or 5 PRs a week instead of 8.
This makes the same change as govuk-forms/forms-admin#3263.
Things to consider when reviewing
sentryandvite_rubynow only group major bumps. Their minor and patch bumps go in the gem groups.update-typeis a patch. For a grouped PR,fetch-metadatareports the highest bump in the group, so a gem group will only auto-merge in weeks when every bump in it is a patch.